CVE-2017-5602

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-5602
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5602.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-5602
Published
2017-02-09T20:59:00.373Z
Modified
2026-05-18T11:38:53.168107Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for jappix 1.0.0 to 1.1.6.

References

Affected packages

Git / github.com/jappix/jappix

Affected ranges

Type
GIT
Repo
https://github.com/jappix/jappix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
67da6a9301b2ca016aaa2f81c110e80cea77e3e6
Last affected
9a5c5e4f4abc567f9e0a31f970c15356780a4c29
Last affected
f8fed985bda2457b19f9efbed72f9960174262c6
Last affected
8f3c32c4f60379f881199ba762a67603320094ef
Last affected
16f05ab89f3144d5db54ea5b8e64c219827454bc
Last affected
1d82c80efb9f42437d726327ff52885fe8a0c845
Last affected
8c40527f30f660823cd05b7fed7e06759fae5c66
Last affected
894e7a827c179ff575f847ebfdfc98f56c089cb9
Last affected
dee0efa21aaa32c2af88054d5f42c901013bd880
Last affected
54437753025f62554840f7974ae2019a7dbf5cb0
Last affected
b1e50c586b8d6096cbee9c1b7dab0cbec7a7f6a0
Last affected
f1267bfa0811adbf43ffdcd1a1f76ecda8d61c3f
Last affected
1d4bc4b5fe304cbb96cf36d4004cbb1aa192f077
Last affected
8569462a96ead9d31679593d726615bfc1443355
Last affected
97e3d81c3941fccd310c8f5fc2a55deb7f68bb39
Database specific 
{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "last_affected": "1.0.2"
        },
        {
            "last_affected": "1.0.3"
        },
        {
            "last_affected": "1.0.4"
        },
        {
            "last_affected": "1.0.5"
        },
        {
            "last_affected": "1.0.6"
        },
        {
            "last_affected": "1.0.7"
        },
        {
            "last_affected": "1.1.0"
        },
        {
            "last_affected": "1.1.1"
        },
        {
            "last_affected": "1.1.2"
        },
        {
            "last_affected": "1.1.3"
        },
        {
            "last_affected": "1.1.4"
        },
        {
            "last_affected": "1.1.5"
        },
        {
            "last_affected": "1.1.6"
        }
    ],
    "cpe": [
        "cpe:2.3:a:jappix_project:jappix:1.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.1.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.1.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.1.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.1.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:jappix_project:jappix:1.1.6:*:*:*:*:*:*:*"
    ]
}

Affected versions

0.*
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5602.json"